Windows XP only - Firebird/Mozilla Fails to Restrict Access to "shell:"

Capt'n Midnight

http://secunia.com/advisories/12027/

The vulnerability affects Mozilla, Mozilla Firefox, and Mozilla Thunderbird on the Microsoft Windows XP platform due to the way the "shell:" URI handler is used and implemented on Windows XP.

The shell: URI handler is inherently insecure and should only be accessed from a few trusted sites - or not from a browser at all. Multiple exploits in Internet Explorer also utilise "shell:" functionality.

SOLUTION:
This has been fixed in the following versions:

Mozilla 1.7.1
http://ftp.mozilla.org/pub/mozilla.org/mozilla/releases/mozilla1.7.1/mozilla-win32-1.7.1-installer.exe

Mozilla Firefox 0.9.2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/0.9.2/FirefoxSetup-0.9.2.exe

Mozilla Thunderbird 0.7.2
http://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/0.7.2/ThunderbirdSetup-0.7.2.exe

irishgeo

There is an xpi update avavilable from update.mozilla.org but it only installs on a single profile.

You have to install it on each profile you have.

Capt'n Midnight

You're not wrong there -
ShellBlock 1.0 By mozilla.org
ShellBlock fixes Bug 250180, by disabling the shell protocol handler.
This fix is for users of all Mozilla products on Windows XP.

http://update.mozilla.org/extensions/moreinfo.php?application=firefox&id=154&vid=263
1KB (one kilobyte!)

leeroybrown

It's nice to see that the problem was fixed swiftly. In fact compared to a certain other browser, it's just nice to see the problem fixed at all.